Executive brief
djv is a popular JSON Schema validator used to validate data against schema definitions. If an application uses djv to validate data against a schema that an attacker can control or influence, the attacker can inject malicious JavaScript code into that schema that will execute with the privileges of the application. This could allow the attacker to read files, modify data, or gain control of the entire system running the application.
Technical details
djv contains an arbitrary code execution vulnerability (CWE-94) stemming from unsafe evaluation or template injection in schema processing. The vulnerability is exploited by crafting a malicious JSON schema where properties contain injected JavaScript code (e.g., in minItems fields). When the schema is added and validated against data, the injected code is executed via eval or similar mechanisms rather than being safely parsed as schema constraints. No authentication or special privileges are required; the attack only requires the ability to control the schema input to the validator. An attacker can achieve full code execution to run arbitrary system commands. The vulnerability was patched in version 2.1.4; affected versions are 2.1.3 and earlier.
Affected products
- djv djv <2.1.4
Timeline
- 2020-09-30: disclosed: Vulnerability disclosed to Snyk
- 2021-01-04: advisory: NVD published CVE-2020-28464
- 2020-12-27: patched: Fix merged in PR #98
- 2021-04-13: other: GHSA-4hv7-3q38-97m8 published